I just use both. Use randomly generated tokens that you use to look up user information in your database, but also sign that token and present it as a JWT.